Vulnerabilities exploitable today
378,068in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,716
New KEV · 24H0
Exploit Today ≥ 701,651
Distribution · last window
- Critical2,293
- High8,417
- Medium6,703
- Low757
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2014-6501—31.8%
——10——CVE-2022-43376—31.8%
——10——CVE-2024-1658—31.8%
——10——CVE-2025-138156.3 MED31.8%
——10A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. The affected element is an unknown function of the file /file/pictures. This manipulation of the argument filedatas causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.19dCVE-2024-13732—31.8%
——10——CVE-2025-58642—31.8%
——10——CVE-2024-3544—31.8%
——10——CVE-2025-68560—31.8%
——10——CVE-2011-0636—31.8%
——10——CVE-2026-349795.3 MED31.8%
——10OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are no publicly available patches.59dCVE-2022-03307.8 HIG31.8%
——10A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.47dCVE-2025-64063—31.8%
——10——CVE-2010-3376—31.8%
——10——CVE-2023-41662—31.8%
——10——CVE-2023-5980—31.8%
——10——CVE-2015-5824—31.8%
——10——CVE-2024-40897—31.8%
——10——CVE-2024-45653—31.8%
——10——CVE-2014-6211—31.8%
——10——CVE-2026-24142—31.8%
——10——CVE-2023-41856—31.8%
——10——CVE-2000-0373—31.8%
——10——CVE-2023-26410—31.8%
——10——CVE-2015-0200—31.8%
——10——CVE-2023-51461—31.8%
——10——CVE-2013-0200—31.8%
——10——CVE-2026-674455.3 MED31.8%
——10Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine() using bufio.Reader.ReadString before session.parseLine() parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticated remote SMTP client can send an oversized single command line that is fully allocated before syntax rejection or timeout, and the normal MaxMessageSize and DATA limits do not apply to this pre-DATA path. The same command reader is used by handleAuthLogin(), handleAuthPlain(), and handleAuthCramMD5() continuation lines, so concurrent oversized inputs can create memory pressure and reduce service availability. This issue is fixed in version 1.30.4.3dCVE-2005-4511—31.8%
——10——CVE-2024-38467—31.8%
——10——CVE-2024-56179—31.8%
——10——CVE-2022-26362—31.8%
——10——CVE-2026-563506.3 MED31.8%
——10n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.81dCVE-2018-1841—31.8%
——10——CVE-2020-27801—31.8%
——10——CVE-2026-896119.8 CRI31.8%
——10In the Linux kernel, the following vulnerability has been resolved:
ntfs: validate non-resident attribute offsets
ntfs_attr_update_meta() shifts the attribute name when converting between
non-sparse and sparse attributes. Converting to sparse also adds the
compressed_size field before the name and mapping pairs, requiring eight
additional bytes in the attribute record.
However, the validator does not check that name_offset is within safe
boundaries for these operations or that the additional space is available.
A malicious MFT record could set name_offset such that:
1. The name is positioned at the very end of a non-sparse attribute.
Converting to sparse would shift the name forward by 8 bytes,
writing beyond the attribute boundary.
2. The name overlaps with the mapping pairs, causing corruption during
conversion.
Add validation to ensure:
- For named attributes, name_offset is within valid bounds
- Name does not extend beyond the attribute or overlap with mapping pairs
- For non-sparse, non-compressed attributes, eight bytes are available
after mapping_pairs_offset for the compressed_size field
The space check also covers unnamed attributes, for which name_offset = 0
is valid and no name range needs to be checked.8dCVE-2026-763198.8 HIG31.8%
——10In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fsh_manage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all relevant data and affect system integrity and availability. The vulnerability is possible because the Federated Search dispatch flow accepts caller-controlled bundle selection without enforcing the capability that manages federated providers and indexes. For more information see Security models for Federated Search for Splunk (https://help.splunk.com/en/splunk-enterprise/search/federated-search/10.4/run-federated-searches-across-other-splunk-deployments/service-accounts-and-security-for-federated-search-for-splunk/security-models-for-federated-search-for-splunk) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.25dCVE-2017-18257—31.8%
——10——CVE-2023-51459—31.8%
——10——CVE-2025-41396—31.8%
——10——CVE-2023-51460—31.8%
——10——